SIA Calls for Greater Collaboration To Improve HSPD-12 Implementation
In recent testimony before the U.S. House Subcommittee on Government Management, Organization and Procurement, Rob Zivney, vice president of Marketing for Hirsch Electronics and member of the Security Industry Association Board of Directors, called implementation of HSPD-12 a pioneering effort which will require both a financial investment and development of new infrastructure.
“The opportunity to testify on behalf of our industry is a testament to the legislative inroads and successes SIA has realized in recent years,” said Richard Chace, executive director and CEO, The Security Industry Association. “We look forward to working closely with committee members to implement our recommendations.”
At the hearing, Zivney urged the subcommittee to direct the Office of Management and Budget’s (OMB) Office of E-Government and Information Technology to establish a dedicated “physical security team” composed of professionals with substantial knowledge of physical security technologies and physical security infrastructure within federal agencies. As part of its responsibilities, this physical security team would support the ongoing efforts of the Interagency Security Committee charged with developing physical security policies, standards, and strategies at non-military government facilities.
He also recommended OMB establish a policy for implementation of physical security similar to OMB Memorandum M-05-24. Currently, PIV-I and PIV-II are “unfunded mandates.” However, physical access control systems are outside of that scope and have neither funding nor a mandate. This requested policy must recognize that the PIV card is not compatible with most installed PACS currently in use and that the PACS will have to be, at a minimum, upgraded or most likely, replaced.
Finally, Zivney called on the committee to use SIA as a resource for the effective utilization of the PIV credential with physical access control systems. He noted that SIA not only has the skills and knowledge for deployment and use, but as an ANSI standards development organization, is able to produce standards for physical security systems.
Additional highlights of Zivney’s testimony include:
- HSPD-12 and the associated standards developed by the National Institute of Standards and Technology (NIST), specifically the identity vetting processes, form a far stronger foundation for our federal government agencies’ security than we have ever witnessed in the past.
- The scope of the investment and time required for HSPD-12 implementation were underestimated by the government when it set goals for the deployment of HSPD-12 through the OMB Memorandum M-05-24.
- Traditionally the functions of authentication and authorization have resided locally with the administrator of the physical access control system (PACS). The HSPD-12 and Federal Information Processing Standard (FIPS) 201 model have changed this: the credential issuer to a large degree now handles authentication while authorization remains a function of the PACS. This has created a unique challenge facing federal agencies, the development of a substantial shared infrastructure to accommodate the increased functionality and security features of the PIV II credential.
- HSPD-12 requires information technology departments, human resources, and security departments interface and cooperate on an unprecedented level. These three disciplines traditionally are different in cultures and basic objectives. This creates challenges for all parties involved.
- In the absence of clear guidance and specifications for the systems that will use the PIV card, some manufacturers have stepped up to the challenge and assumed substantial research and development costs to produce next generation equipment capable of utilizing the features of a PIV II credential. This work has been conducted without the benefit of having operational PIV II credentials available to manufacturers to develop and test associated product.